Higher Security Thresholds for Quantum Key Distribution by Improved Analysis of 

Dark Counts 
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We discuss the potential of quantum key distribution (QKD) for long distance communication 
by proposing a new analysis of the errors caused by dark counts. We give sufficient conditions for 
a considerable improvement of the key generation rates and the security thresholds of well-known 
QKD protocols such as Bennett-Brassard 1984, Phoenix-Barnett-Chefles 2000, and the six-state 
protocol. This analysis is applicable to other QKD protocols like Bennett 1992. We examine two 
scenarios: a sender using a perfect single-photon source and a sender using a Poissonian source. 

PACS numbers: 03.67Dd 



The goal of quantum key distribution (QKD) is to ex- 
tend a shared secret key for use as a one-time pad to 
encode classical messages. The advantage of QKD is 
that its security is based on the laws of quantum me- 
chanics and not on the unproven complexity of a mathe- 
matical problem as in classical cryptography. These last 
few years, many encouraging experiments demonstrated 
QKD, some spanning more than a hundred kilometers 
through optical fibers The main source of errors is 
usually due to dark counts from the detectors. A dark 
count is when a detector fires independently (or in the 
absence) of a qubit state encoded by the sender, Alice. 
If qubit losses are considerable, then the receiver, Bob, 
will receive many empty pulses, and dark counts from his 
detectors will induce a high error rate. 

In this paper, for simplicity, we refer specifically 
only to four different QKD protocols: Bennett 1992 
(B92), Phoenix-Barnett-Chefles 2000 (PBC00), Bennett- 
Brassard 1984 (BB84), and the six-state protocol, which 
are two, three, four, and six state protocols, respec- 
tively 0,0.0,0 In B92, Alice encodes random bits using 
two non-orthogonal states, say \ipi) and \ip2), and sends 
them to Bob. He makes the measurement correspond- 
ing to the Positive Operator- Valued Measure (POVM) 
{a\il; 1 }(tp 1 \,a\tlj 2 }(il; 2 \,t-a\i) 1 )(tp 1 \-a\ij 2 )(ij 2 \}, where 
is orthogonal to and a equals poT^-r^yi ■ Bob's 
measurement either determines which state Alice did not 
send (from which Bob can deduce the encoded bit) or is 
inconclusive. PBC00 is similar to B92 but uses three non- 
orthogonal states, say IV'i), IV^) and | "03 ) ^ that form an 
equilateral triangle in the X-Z plane of the Bloch sphere. 
She encodes her random bits using random bases from 
either {|V>i), \tp 2 )}, W2), [^3)}, or {|^ 3 ), |^!i}}._Bob per- 
forms the POVM {fl^XM fl^aXtfal, f I^X^II- Af- 
tcr Bob measures all of the qubits, Alice declares publicly 
which basis she used for each. By deduction, Bob can 
sometimes retrieve Alice's state. Alice and Bob discard 
the other results. It can be shown that, neglecting the 
qubit losses, the rate of conclusive results is 2 _ 1 e where 
e x is the bit error rate. A conclusive result corresponds 
to any pair of qubits not discarded by Alice and Bob. 

To implement BB84, Alice encodes a random bit in 



either {|0), |1)} or its conjugate basis {|+),|— )}■ For 
each qubit, Bob randomly measures in one of these bases. 
They only keep results for which they used the same ba- 
sis. The six-state protocol is identical to BB84 except 
that Alice and Bob choose from three different bases: 
{|0>, |1)},{|+), I-)}, and {^(|0) + ^(|0) - 
We can modify BB84 and the six-state protocol by choos- 
ing bases with non-equal probabilities, increasing the 
chance of agreement |fg. The rate of results for which 
identical bases are used converges asymptotically to 1. 
Below, we calculate the key generation rates of BB84 
and the six-state protocol using this asymptotic result. 

Mayers Q produced the first unconditional security 
proof of BB84. Shor and Preskill Q proposed a simpler 
proof based on ideas from Lo and Chau [9j . Their security 
proof has been generalized to other protocols inclu ding 
B92, PBC00, and the six-state protocol [13, El El El. 
We improve the secret key generation rate of these QKD 
protocols by proposing a slight modification of these 
proofs. Our main idea is based on a variation of a theo- 
rem proved in Ref. E3- We assume that an eavesdrop- 
per, Eve, can perform any attack consistent with quan- 
tum mechanics, but cannot get any information about 
Alice's or Bob's labs or control their apparatus. We dis- 
cuss later how realistic these assumptions are and how it 
is possible to slightly relax them. We study two cases: 
one where Alice's source can create a single photon on 
demand, and another where it follows a Poisson distribu- 
tion. For simplicity, we give details only about Shor and 
Preskill's security proof of BB84 and not other protocols. 

At the end of this paper, we compare the updated er- 
ror rate thresholds and key generation rates of BB84, 
PBC00, and the six-state protocol with previous results. 
The same arguments could improve other QKD proto- 
cols, including B92. However, B92's phase estimation 
bound depends on qubit losses in the channel and the 
number of inconclusive results, complicating the analy- 
sis. Since our goal is to describe a general technique to 
improve security thresholds, we only treat the simpler 
cases as examples. 

The Shor and Preskill proof first shows the secu- 
rity of an entanglement distillation protocol (EDP) for 
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QKD, and subsequently reduces the EDP to BB84. For 
convenience, we define |$ ) = -i=(|0}|0) ± |1)|1)) and 

|*±> = ^(|0)|1>±|1)|0>). 
The structure of the EDP that can be reduced to 

BB84 in Shor and Preskill's proof is as follows: 

1. Alice creates n pairs of the form |$ + ) and sends the 
second half of each pair to Bob after randomly applying 
the identity or the Hadamard gate on it. 

2. After Bob confirms that he has received all of Alice's 
states, Alice publicly declares the random rotation that 
she used on each qubit. Bob undoes the transformations 
on the corresponding qubits. 

3. With no eavesdropping or channel noise, Alice and 
Bob will share n perfect pairs of the form |$ + ). They 
can now measure their qubits in the same basis to share 
a secret key. However, noise and eavesdropping induce 
errors. If the bit and the phase error rates are low enough, 
then error correction can be applied to obtain m perfect 
pairs of the form where m ^ n. 

4. Alice and Bob can estimate the bit error rate by com- 
paring bit measurements from a sample of pairs, called 
test bits. A bit (or X) error on a pair occurs when Al- 
ice and Bob share either \^> + ) or 1 3 / ~}. A phase (or 
Z) error corresponds to |$ _ ) or 'J - ). A Y error corre- 
sponds to |$~) or \^ + ). Y error estimation could pro- 
vide information about the correlation between bit and 
phase errors. Because Alice randomly applies the iden- 
tity or Hadamard gate, it can be shown that the bit error 
rate, e x , and the phase error rate, e z , are approximately 
equal, independent of channel noise and Eve's strategy. 
In BB84, Alice and Bob have no information about Y 
errors. 

5. Depending on the bit error rate measured on the test 
bits, Alice and Bob apply error correction on the other 
pairs. If we suppose one-way error correction using CSS 
codes a lower bound for generation rate ^ for the 
perfect pairs is given asymptotically by 

S = p c [l-H(e x ,e z )} (1) 

where H is the Shannon entropy (H(e x ,e z ) = H(e x ) + 
H(e z \e x ) is the entropy of the bit-phase error pattern) 
and p c is the rate of conclusive results. For simplicity, we 
assume that the proportion of test bits is negligible. □ 

Shor and Preskill showed that this EDP, and thus 
BB84, were unconditionally secure with a key genera- 
tion rate given by Eq. ^ Since H(e x ) is asymptotically 
the fraction of bits sacrificed for bit error correction, it 
implies that H(e z \e x ) is an upper bound on the frac- 
tion of information that Eve has about the key after bit 
error correction. A consequence is that privacy amplifi- 
cation, as introduced in Ref. jl6| |. can be used to simplify 
the post-processing of the QKD protocol. As shown in 
Ref. 01 > privacy amplification can generate a secret key 
by sacrificing a number of bits asymptotically propor- 
tional to Eve's information. 

The reduction of the EDP to BB84 assumes that Alice 
uses a source which emits a single photon on demand. 



In a more realistic situation, Alice's source would emit a 
photon pulse following a Poisson distribution. Unfortu- 
nately, when Alice sends two or more photons containing 
the same quantum information at the same time, Eve can 
measure one to gain information about the key without 
detection. Accounting for this attack (but assuming Eve 
has no information about the random phase of the signal 
emitted by a coherent light source), a more general equa- 
tion of the secret key generation rate, combining results 
from Ref. ^4| and Ref. 0], and using the improvement 
suggested in Ref. 0, is given asymptotically by 

S = p c [uJo +u>i- H(e x ) - LOiH{e\\e x )\ (2) 

where u)\ is the fraction of the conclusive results cor- 
responding to single-photon pulses, ujq is the fraction of 
the conclusive results corresponding to empty pulses (the 
presence of background noise, for example), and e x (el) is 
the bit (phase) error rate restricted to conclusive results 
from single-photon pulses. e x (e 2 ) is still the bit (phase) 
error rate over all conclusive results. If Alice has a source 
that emits a single photon on demand, then luq = 0, 
0l>! = 1, e] = for j e {a;,?/, z}, and # = p c [l-H(e x ,e z )] 
as expected. 

To prove Eq. |2 it was argued that since Alice and 
Bob want an identical key and cannot differentiate multi- 
photon from single-photon pulses, they must correct all 
bit errors, asymptotically losing a fraction H(e x ) of the 
results in the process. To apply privacy amplification on 
the remaining bits and obtain a secret key, Alice and Bob 
must upper bound Eve's information. If we assume that 
the phase of the signal is random 1 , there is no coherence 
between states with different photon numbers. Thus, we 
can categorize each bit of the resulting key as being as- 
sociated with an empty, single-, or multi-photon pulse. 
Assuming the worst case, Eve has full information about 
the results associated with multi-photon pulses. On the 
other hand, she has no information about Alice's bits 
corresponding to empty pulses. By the Shor-PreskilPs 
arguments discussed earlier, the fraction of information 
that Eve could extract from the results corresponding to 
single-photon pulses is upper bounded by H(e\\e x ). Con- 
sequently, Eve's information about Alice's remaining key 
is upper bounded by (1 — ujq — uj\) + u>\H(e\\e x ). Af- 
ter privacy amplification, Eve has no information about 
Alice's key. The same is true of Bob's key since it is iden- 
tical to Alice's. Therefore, the secret key generation rate 
is given by Eq. [2J 

Similarly, since Shor-Preskill's proof can be adap ted to 
B92, PBC00 and the six-state protocol [HI El El , these 
protocols can be shown unconditionally secure with a key 
generation rate given by Eq. [21 



Recently, it was shown the Eve could use extra information about 
the phase of the signal to her advantage though the extent 
is unknown. 
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The above argument does not differentiate between a 
single photon emitted by Alice that is successfully mea- 
sured by Bob and a single photon that is lost in the chan- 
nel (or taken by Eve) followed by a dark count measured 
by Bob. However, these cases may be analyzed sepa- 
rately. Consider the following four types of conclusive 
results. 

1. Successful measurement of a qubit state (physically 
corresponding to a photon received from the chan- 
nel) that originated from a single-photon pulse. 
Note that the qubit state could have been manip- 
ulated by Eve. 

2. Successful measurement of a qubit state that orig- 
inated from a multi-photon pulse. 

3. Empty pulses from Alice followed by a successful 
measurement of a qubit state by Bob (ie. Eve may 
send a qubit state to Bob even if Alice emits noth- 
ing). 

4. Dark count events: Bob doesn't receive a qubit 
state, but one of his detectors fires. 

The dark count events are independent of Alice's or 
Eve's actions. We define pl mp , p^ q , and p™ q as the 
rate of conclusive results corresponding to qubit states, 
received by Bob, associated with empty pulses, single- 
photon pulses, and multi-photon pulses, respectively. We 
define p°] k as the rate of conclusive results associated with 
dark counts. Note that 

Pc =Pt mp +P s c 9 +P? q +p d c k (3) 

We remark that the background noise has two differ- 
ent contributions: intrinsic and extrinsic. The intrinsic 
contribution is caused by elements from Bob's lab while 
the extrinsic contribution is from external sources. The 
sun and backscattering light in two-way QKD are exam- 
ples of external sources of background noise. Based on 
our assumptions, Eve may control the external sources 
of background noise, but not the ones inside Bob's lab. 
Following our previous definitions, the only contribution 
to p~r is intrinsic. Any external sources will contribute to 
pl mp , p sq , and p™ q since they correspond to Bob receiv- 
ing a qubit state from the channel. For convenience, in 
this paper, dark counts always refer to the intrinsic con- 
tribution of background noise. We assume for simplicity 
that dark counts are independent of other measurement 
results. 

We now explain how it is possible to achieve a better 
bound for the secret key generation rate than Eq. |5J As 
before, a fraction H(e x ) of the results are lost due to 
bit error correction. Assuming again that the phase of 
the signal is random from Eve's perspective, each bit of 
the resulting key corresponds to one of the four types of 
conclusive results described above. From previous argu- 
ments, Eve has a fraction H (e sq \e x ) of information about 
conclusive results from Category 1 and, in the worst case 



scenario, full information about those from Category 2. 
e sq and e sq are defined as the bit and phase error rates on 
the conclusive results restricted to Category 1. When Al- 
ice emits an empty pulse and it is followed by a successful 
measurement of a qubit state by Bob, we assume that the 
qubit state was created by Eve. A conservative assump- 
tion is that Eve has full information about Bob's results 
from Category 3. 2 Supposing dark count rates are the 
same in all detectors and independent of Eve and other 
measurement results, Bob's results from Category 4 are 
completely random and Eve has no information about 
them 3 . Consequently, the fraction of information that 
Eve has on Bob's key after bit error correction is upper 
bounded by j : (p e c mp + pT q + Pl q H{e sq \e x )). Therefore, 
the secret key generation rate is lower bounded by 

S b = p sq + v? - PcH(e x ) - p sq H{e sq \e x ). (4) 

We emphasize that it is not necessary for Alice and Bob 
to know which events correspond to each class of conclu- 
sive results. 

In the derivation of Eq. we bounded Eve's informa- 
tion about Bob's key. However, we could have instead 
bounded Eve's information about Alice's key. In this 
case, Eve has no information about the bit chosen by Al- 
ice when she sends a vacuum states. But she could have 
some information about Alice's portion of the key cor- 
responding to dark counts (unless Alice sent an empty 
pulse). Using similar arguments, we obtain 

S a = p sq + Pc lo - p c H(e x ) - p sq H(ef\e x ). (5) 

Combining Eq. ^ and Eq. [31 we obtain a new lower 
bound for the secret key generation rate, 



2 In the case of B92, it is easy to show that this assumption is nec- 
essary, but it might be too strict for other protocols like PBCOO, 
BB84, and the six-state protocol. 

3 For simplicity, we suppose that the dark count rates are uniform 
over all detectors and that they are independent of other mea- 
surement results. If dark count rates differ from detectors, we 
suggest two options. In one, Bob uses a random transforma- 
tion to switch the role of the detectors in the measurement. For 
example, in BB84, Bob could apply, at random, an extra Y op- 
eration on the received qubits to switch the role of the detectors 
when measuring in the {|0}, |1}} and {|+), |— )} bases. A second 
option is to bound Eve's information from an estimate of the 
probability that a detector fires relative to the others in the case 
of a dark count. Assuming dark counts are independent of other 
measurement results, in BB84 and the six-state protocol, with 
only two detectors, Eve's information is bounded by 1 — H(q) 
where q is the probability that the first detector fires in the case 
of a dark count. It is interesting to note that if Eve has some 
control over the probability q and could change it from one dark 
count event to another, then, by entropic concavity, Eve's infor- 
mation is bounded by 1 — H(q%?JL t ), wnere it^rst * s * ne wors t 
estimate of the average of q. Determining the value of q^^rst can 
be very hard, but it is related to the level of confidence that Al- 
ice and Bob have on their ability to counter or detect Eve if she 
tries to change the properties of the detectors. Similarly, if dark 
counts are correlated to other measurement results, we can upper 
bound Eve's information with restrictions on the correlations. 
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S = max[S a ,Sb\- (6) 

Remark that the concavity of entropy and u>\er z — 
*ge? + (wi - £)e? imply that wiH(£\e x )) > 
^.ff(e*«|e x ) + (wi - ^)H{ef \e x ). We can rewrite this 
as — H{e\\e x )) ^ ~ H(e s z q \e x )), since it can 

be argued that e dk = 5. Therefore, the secret key gen- 
eration rate given by Eq. 0(and Eq.EJ) is always greater 
than or equal to the one given by Eq. [2J 

To evaluate Eq. Alice and Bob must be able to de- 
termine all quantities involved in it. For this purpose, 
we study two different situations: Alice has a source that 
emits a single photon on demand or one that follows a 
Poisson distribution. 

In both situations, e x is estimated from test bits, and 
p dk can be calculated from the predetermined dark count 
probability C of the detectors and the number of empty 
pulses not associated with dark counts that Bob receives. 
If C is not fixed, Bob might block his detection units ran- 
domly and estimate p dk from these results. For this to 
be true, it is important that Eve is not allowed to reduce 
the dark count probability without being detected. But 
is this a valid assumption? In practice, Eve could try to 
cool down the detectors or send bright pulses to disable 
them at will. Furthermore, there might be some uncer- 
tainty in the measurement of p dk , even in the absence of 
an eavesdropper. Since a dark count could be interpreted 
as Eve sending a random state to Bob, we remark that 
lower bounds for C and p dk are sufficient to obtain a bet- 
ter key generation rate using Eq. EJ Establishing a high 
level of confidence on a lower bound for p dk seems very 
hard in practice. However, it might be possible through 
experimental research and tests on reducing dark count 
rates of detectors. 

If Alice has a source that emits single photons, ojq = 
and p™ q = 0, then Eq. reduces to Eq. 0] and e x = 
^-{p sq e sq + p dk e dk ), where e dk is the bit error rate over 

conclusive events associated with dark counts. e dk = | 
which implies that Bob can estimate e sq from the value of 
e x measured on test bits. H(e sq \e x ) = H(e z q \e s x q ) can be 
evaluated depending on the protocol used. It can easily 
be shown that, for the six-state protocol, e sq = e sq = 
e sq [12. For BB84, e sq = e sq and O^e^ 2e sq @. For 
PBC00, it was shown that e sq = §e*« and \e sq sC e sq ^ 

In the absence of errors due to dark counts, p dk = 0. 
By solving S(e x ) = 0, we find that the bit error rate 
threshold is 12.6% for the six-state protocol, 11.0% for 
BB84, and 9.81% for PBC00. If we now suppose that 
e sq is fixed, then the bit error rate threshold increases as 
shown in Tab. [I] Note that the bit error rate threshold 
depends on the contribution of errors not associated to 
dark counts. 

Tab. |U reflects the potential of a special analysis for 
dark counts. For any of the previous QKD protocols, if 



TABLE I: Bit error rate thresholds for BB84, PBC00, and the 
six-state protocol using a single-photon source and assuming 
fixed values of ej 9 , which is the bit error rate of the results 
not associated with dark counts. 





e^ = 


e s J> = 0.01 


e% q = 0.1 


PBC00 


50% 


43% 




BB84 


50% 


44% 


13% 


Six-State Protocol 


50% 


46% 


19% 



the errors are only caused by dark counts {e sq = 0), then 
the bit error rate threshold is 5, which implies there is 
no bound on the distance for communication. However, 
we must keep in mind that this result is derived using 
many special conditions. In practice, e sq is non-zero and, 
since there is decoherence in the channel and extrinsic 
sources of background noise, e sq usually increases with 
the distance of communication. We also assumed that 
Alice and Bob perfectly know the dark counts rates of 
their detectors, that they are the same for all detectors, 
that they are independent of other measurements, and 
that Eve cannot lower them. However, even if one or 
more of these assumptions are not respected, it is still 
possible to slightly modify Eq.|Sl as we explained earlier, 
and obtain an improvement over Eq. [21 
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Distance (in units of 1/A) 

FIG. 1: Semi-log graph of the key generation rate of PBC00, BB84, 
and the six-state protocol as a function of distance, I, for ej 9 = 0.01 
and C = 10 -6 calculated using the old method (Eq.|5J and the new 
one (Eq. |HJ assuming a perfect single-photon source {p™ q = 0). 

In Fig. n we observe that the new method of calcu- 
lating the key generation rate, using Eq. El improves the 
achievable distance for PBC00, BB84, and the six-state 
protocol assuming a single-photon source. For simplic- 
ity, we suppose that the dark count probability, C, is 
the same for all detectors and that e sq is fixed and in- 
dependent of distance. We assume no qubit losses at 
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1 = 0, where I is the length of the channel, and neglect 
events when two different detectors fire simultaneously. 
Under these conditions, for BB84 and the six-state pro- 
tocol, p sq rs 77 and p°\ k m 2(7(1 — 77), where r\ = e~ Al is the 
probability that a photon successfully travels through the 
channel and A is the attenuation in the fiber. For PBCOO, 
P S c 9 ~ T~T^ anc ^ Pc k ~ 2(7(1 — 77). Note that, since 
— is always equal or higher in PBCOO than for BB84 

Pc 

or the six-state protocol, PBCOO's maximum achievable 
distance is lower for the same bit error rate. 

We now consider the case where Alice uses a source 
that follows a Poisson distribution (p™ 9 7^ 0). We only 
provide the result for BB84, but our arguments are valid 
for other QKD protocols, including B92, PBCOO, and the 
six-state protocol. 




Distance (units ot 1/A) 



FIG. 2: Semi-log graph of the key generation rate of BB84 as a 
function of distance, /, for ej 9 = 0.01 and C = 10 — 6 assuming a 
Poissonian source and combined with the decoy state method with 
p, = 0.5. We compare the key generation rates calculated using 
Eq. Eland Eq.® 

Decoy states [2(j could be used to evaluate p sq and 
e sq precisely. Ref. [2TL 122^ explain how Alice could 
randomly vary the average photon number, /i, of her 
source to obtain, from statistics, precise estimates of the 
rate of conclusive results associated with single-photon 



pulses, p c u, and the corresponding bit error rate, e\. 
p sq and e sq can be easily derived from the following 
two relations: p c uj = p s c q + 2Ce~ fi p(l — rj) and e\ = 
e~^\i(j]e sq + 2(7(1 — ^)e^ fe )/(p c a;), where /I is the global 
average photon number. Fig. [2] shows that the decoy 
state method can also be improved by using Eq. El 

If we don't use decoy states, a worst case estimate of 
p aq and e sq is possible. However, Eq. provides only 
a small improvement since, without decoy states, multi- 
photon pulses are usually a much more important limit- 
ing factor than dark counts. 

In this paper, we showed that a high confidence in 
the stability of the dark counts of the detectors against 
the possible attack of an eavesdropper implies a signifi- 
cant increase of the robustness of most QKD protocols 
against dark counts, one of most important contributors 
of noise in quantum communication. We studied partic- 
ularly the cases of PBCOO, BB84 and the six-state pro- 
tocol. We explained how to get an improvement of the 
secret key generation rate and of the achievable distance 
in some non-ideal situations, including when Alice uses 
a Poissonian photon source, when Alice and Bob know 
only a lower bound for the dark count rates of their de- 
tectors, and when the dark count rates are not uniform 
over the detectors. Further improvements to the secret 
key generation rate might come from using two-way error 
correcti on 1231 and by artificially adding some errors in 
the key H|P 
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Gottesman and Hoi-Kwong Lo, whose contributions are 
greatly appreciated. We thank Nicolas Gisin who pro- 
posed using reverse reconciliation. We also thank Tony 
Anderson for his assistance. J.-C.B. and R.L. acknowl- 
edge support from the Government of Ontario, J.B. and 
R.L. from NSERC, and R.L. from CIAR, MITACS and 
ARDA. 
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